Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Mar 2010 17:52:46 -0500
From: Reed Loden <>
Cc: "Steven M. Christey" <>
Subject: CVE Request: ViewVC 1.1.5 / 1.0.11 -- XSS via user-provided
 'search_re' input

Just received an announcement stating ViewVC 1.1.5 and 1.0.11 were
released today (right on the heels of 1.1.4 and 1.0.10, for which I
still haven't received a CVE). Looks like they fix an XSS that needs
a CVE assigned.

"security fix: escape user-provided search_re input to avoid XSS

Here's the patch for the XSS:

There were too many ways to do something as simple as HTML escaping in
the ViewVC codebase.  Simplify, conjoin, remove, etc.

* lib/
  (escape): New function.  *The* preferred HTML-escaping mechanism.
  (Server.escape): New common Server object escape mechanism (which
    uses the aforementioned escape(), of course).
  (CgiServer.escape, WsgiServer.escape, AspServer.escape,
   ModPythonServer.escape): Lose as unnecessary.

* lib/
  (Request.get_form): Escape hidden form variable names and values.
  (htmlify): Remove.
  (): Replace all uses of cgi.escape() and htmlify() with (directly or
    indirectly) sapi.escape().
* lib/
  (main): Use server.escape() instead of cgi.escape().

* lib/
  (HTMLBlameSource.__getitem__): Use sapi.escape() instead of

* lib/
  (_mdiff_split, _differ_split): Use sapi.escape() instead of


Reed Loden - <>

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.